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What Is Claimed Is : 

1 Pt%H 1 . A method for optimizing the operation of an anti -virus computer program for 

2 use with an operating system, comprising the steps of: 

3 detecting a request for closure of an opened computer file; 

4 determining in response to a closure request if the opened computer file has 

5 been modified since being opened; / 

;|j6 scanning said opened file for/viruses before closure only if said opened file has 

^7 been modified; and / 

_ t * 

' T~ / 

1**8 closing said file if unmodified, and closing said file after scanning for viruses 

t ri I 

n 9 if found virus free. / 

* / 

• =»i / 

;ff 1 2. The method of Claim 1, /further including before said detecting step, the steps 

l=J 2 of: / 

3 determining whether sAid operating system includes a "dirty cache buffer" to 

4 raise or set a modification flag relative to a file being modified during the time it has been 

5 open, a computer code being indicative of said flag; and 

6 using the computer code for a raised or set modification flag, if available, for 

7 carrying out said modification determining step by checking for the presence of a raised 

8 modification for said file. 
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1 3. The method of Claim 2, wherein if it is determined that said operating system 

2 does not provide a file modification flag, saia method further includes the steps of: 

3 establishing a "dirty cache buffer"; I 

4 and / 

5 raising a modification flag in said "dirty cache buffer" if an opened file associated 

6 with said flag has been modified by a write operation. 

/ 

;fjl 4. The method of Claim 1, wherein said operating system includes a "dirty cache 

1 J']2 buffer" for providing a computer code fir a modification flag indicative of the modification 

: l= ( 

i**3 of an open file, said method further incmding in said modification determining step, the step 

f 4 of: I 

=£15 detecting the presence of said modification flag to determine if the associated 

**6 opened file has been modified. I 

*«! I 

1 5. The method of claim 4, further including the steps of: 

2 scanning a file for viruses in response to a request for opening the file; 

3 opening said file if virus free! 

4 establishing a cache buffer n emory for storing upon opening of a file only a virus 

5 vulnerable portion of that file that a virus must use to enter and infect said file; 

6 said modification determinir g step including the steps of: 

7 indicating an open file is unmodified in the absence of an associated 

8 modification flag; 1 



* • 
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9 responding to the presence of a modification flag by comparing a portion of 

10 said open file to the associated unmodified virus vulnerable portion of said file in said cache 

1 1 buffer memory to determine if the portion of the open file has been modified since the 

1 2 opening of the file; I 

13 indicating the opened file is unmodified is the virus vulnerable portion is 

14 unmodified; and / 

15 indicating the opened file is moaified if the virus vulnerable portion is 
1 :|16 modified. / 

m I 

:** 1 6. The method of Claim 1, wherein said step of determining in response to a closing 

~*2 request if the opened computer file has been modified since being opened includes the step 
of: / 

;™4 monitoring network protocols to determining if a write packet was initiated for a 

. ~i I 

5 given open file. I 

1 7. A method for optimizing/operation of an anti- virus program in an operating 

2 system, said operating system including programming for raising a flag indicative of 

3 modification of an open file during the ftime the file has been open, said method including the 

4 steps of: | 

5 detecting the event of a/request for closing said file being made to said 

6 operating system; j 

7 determining whether said modification flag has been raised by said operating 
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8 system for said open file; 

9 scanning said open file, in response to said modification flag, for viruses 

10 before permitting said operating system to close said file; and 

1 1 skipping said step of scanning for viruses before closure of said open file, 

12 whenever said modification flag is not present. 

fr2- \ 

1 8. A method for optimizing the operation of an anti-virus program in use in an 

•i)2 operating system, said operating system including programming for raising a flag indicative 

TO of modification of an open file during the time the file has been open, said method including 

: "4 the steps of: \ 

5 scanning a file for viruses in response to a request from an associated 

116 computer user to open and gain access to said file; 
J«f 7 permitting said file to be opened if virus free; 

' e *8 storing upon opening a virus vulnerable unmodified portion of said open file; 

9 detecting the event of a request for closing said open file being made to said 

10 operating system; \ 

1 1 determining whether said modification flag has been raised by said operating 

12 system for said open file; \ 

13 scanning said open file, in response to said modification flag, for viruses 

14 before permitting said operating system to close said file; and 

1 5 skipping said step of scanning for viruses before closure of said open file, 

16 whenever said modification flag is not present; 

\ 15 
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responding to the presence o: 7 a modification flag by comparing the stored 
unmodified virus vulnerable portion of saidjfile to the associated portion of said open file to 
determine if that portion has been modified/ during the time the file has been open; and 

skipping said step of scanning for viruses before closure of said open file if the 
virus vulnerable portion of said open file ifs unmodified. 



9. A computer program product for detecting computer viruses on a file server, 
the file server providing file storage and retrieval services for at least one client computer 
over a network, said computer program product comprising: 



computer code for detecting an 
asking for a requested file from the file 



open request from a client computer, the open request 
server; 

computer code for scanning said requested file for computer viruses, whereby the file 
server is permitted to provide said requested file to the client computer if no computer viruses 
are found therein; 

computer code for detecting a (£lose request from the client computer associated with 
said requested file; 

computer code for accessing afi operating system flag that indicates whether the 
requested file was changed prior to said close request; 

computer code for scanning szld requested file for computer viruses if said requested 
file was changed prior to said close r€ quest; and 

computer code for skipping scanning said requested file if it was not changed prior to 



said close request. 



v 
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10. The computer program prodi ct of claim 9, wherein said operating system flag 
is generated externally to said computer program product by the operating system in order to 
reduce redundant disk writes, whereby said computer code for scanning is invoked upon 
closing of the requested file only when actjual disk writes are made by the operating system 
for the requested file. 



11. The computer program pre duct of claim 10, wherein said computer code for 
accessing uses a file handle generated by the operating system to identify the operating 
system flag corresponding to the requested file, said handle having been generated when the 
file was opened. 



12. A computer program product for detecting computer viruses on a file server, 
the file server providing file storage and retrieval services for at least one client computer 
over a network, said computer program oroduct comprising: 

computer code for detecting an c pen request from a client computer, the open request 

: (server; 

requested file for computer viruses, whereby the file 
server is permitted to provide said requested file to the client computer if no computer viruses 
are found therein; 

ose request from the client computer associated with 



asking for a requested file from the file 
computer code for scanning saic 



computer code for detecting a c 
said requested file; 
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computer code for accessing an operating system flag that indicates whether the 
requested file was changed prior to said cl/se request; 

computer code for skipping seaming said requested file if it was not changed prior to 
said close request; 

computer code responsive to said requested file having been changed prior to said 
close request for determining whether a virus vulnerable portion of said file was changed; 

computer code for skipping scanning said requested file if a virus vulnerable portion 
of said file was not changed prior to said close request; and 

computer code for scanning said requested file if a virus vulnerable portion of said file 
was changed prior to said close request/. 

13. The computer program product of claim 12, wherein said operating system 
flag is generated externally to said co nputer program product by the operating system in 
order to reduce redundant disk writes, whereby said computer code for scanning is invoked 
upon closing of the requested file ony when actual disk writes are made by the operating 
system for the requested file. 

14. The computer program product of claim 13, wherein said computer code for 
accessing uses a file handle generated by the operating system to identify the operating 
system flag corresponding to the requested file, said handle having been generated when the 
file was opened. 
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